/*******************************************************************************
 * Copyright (c) 2005, 2014 springside.github.io
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 *******************************************************************************/
package com.kaoshi.myweb.web.controller.account;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpSession;

import org.apache.commons.lang3.StringUtils;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.IncorrectCredentialsException;
import org.apache.shiro.authc.LockedAccountException;
import org.apache.shiro.authc.UnknownAccountException;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.subject.Subject;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Controller;
import org.springframework.ui.Model;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;

import com.kaoshi.myweb.web.controller.BaseController;
import com.kaoshi.myweb.web.entity.User;
import com.kaoshi.myweb.web.repository.UserDao;


/**
 * LoginController负责打开登录页面(GET请求)和登录出错页面(POST请求)，
 * 
 * 真正登录的POST请求由Filter完成,
 * 
 * @author calvin
 */
@Controller
@RequestMapping(value = "/login")
public class LoginController extends BaseController {
	
	@Autowired
	private UserDao userDao;
	
	@RequestMapping(method = RequestMethod.GET)
	public String login() {
		return "front/login";
	}
	
	@RequestMapping(method= RequestMethod.POST)
	public String loginPost(User currUser,String jcaptchaCode, HttpSession session,Model model,HttpServletRequest request) throws Exception {
		//JCaptcha 验证码jar包，很少仓库有，很容易有问题，暂时屏蔽
		//boolean isJcaptchaRight =  JCaptcha.validateResponse(request, jcaptchaCode);
		boolean isJcaptchaRight =  true;
		  
		if (!isJcaptchaRight) {
			model.addAttribute("message", "验证码错误!");
			//return "front/login";
        }

		//密码加密规则
		//mds,salt=username+password(明文)+slat,迭代1次，参见com.kaoshi.myweb.web.test.ShiroEncrptTest.testMD5()
		Subject user = SecurityUtils.getSubject();
		UsernamePasswordToken token = new UsernamePasswordToken(currUser.getLoginName(),currUser.getPassword());
		
		String rememberme=request.getParameter("rememberMe");
		if(StringUtils.isNotBlank(rememberme)){
			token.setRememberMe(true);
		}else{
			token.setRememberMe(false);
		}
		
		try {
			//会调用 shiroDbRealm 的认证方法 org.springrain.frame.shiro.ShiroDbRealm.doGetAuthenticationInfo(AuthenticationToken)
			user.login(token);
		} catch (UnknownAccountException uae) {
			model.addAttribute("message", "账号不存在!");
			logger.error("登录错误" + uae.getMessage(), uae);
			return "front/login";
		} catch (IncorrectCredentialsException ice) {
			model.addAttribute("message", "密码错误!");
			logger.error("登录错误" + ice.getMessage(), ice);
			return "front/login";
		} catch (LockedAccountException lae) {
			model.addAttribute("message", "账号被锁定!");
			logger.error("登录错误" + lae.getMessage(), lae);
			return "front/login";
		} catch (Exception e) {
			model.addAttribute("message", "未知错误,请联系管理员.");
			logger.error("登录错误" + e.getMessage(), e);
			return "front/login";
		}
	
		return redirect+"/admin/index";
	}
}
